Employee Security Handbook Template (ISO/IEC 27001 A.6.3)

Employee Security Handbook: [Organization name]

A plain-language handbook that tells every person working for [Organization name] the things they must do to keep information safe. It turns the information security policy and the topic-specific policies into everyday habits, and supports awareness under ISO/IEC 27001:2022 + Amd 1:2024 clause 7.3 and Annex A control A.6.3 (awareness, education and training), with links to the controls each rule comes from. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Welcome: why this matters
2. Our promise to you
3. The 14 things everyone must do
4. Who to contact
5. Acknowledgement form
6. Extra rules for some roles
7. Size tiers
8. Keeping the handbook working
9. Records and evidence
10. Where the rules come from
11. References

1. Welcome: why this matters

Every day you work with information that matters: our customers' data, our colleagues' personal details, our plans, our money and our systems. Many attacks do not start with clever hacking. They start with a normal person receiving a convincing email, reusing a password, losing a laptop or sharing a file with the wrong link.

You do not need to be a technical expert to protect information. You need a few good habits. This handbook lists them. Each rule says what to do and, in one line, why it matters.

If you remember only one thing: when something feels wrong, report it straight away. You will never be blamed for reporting.

The full rules are in our information security policy and the policies linked in section 10. If this handbook and a policy ever seem to say different things, the policy applies, and please tell [@isms-manager] so we can fix the handbook.

2. Our promise to you

In return for following these rules, [Organization name] promises to:

1. Give you the tools. You get a managed device, a password manager, multi-factor sign-in and approved tools for sharing files, so the secure way is also the easy way.
2. Train you. You get short training when you join and every year, and extra training if your role needs it.
3. Not blame you for honest mistakes you report. If you click a bad link or send an email to the wrong person and report it quickly, you will not be disciplined for that mistake.
4. Be open about monitoring. We tell you what we monitor on work devices and accounts, and why. We do not watch you through your camera or microphone, and we do not use security tools to measure how hard you work.
5. Listen. If a rule gets in the way of your work, tell us. We would rather fix the rule than have people work around it.

3. The 14 things everyone must do

Rule 1. Use a strong, unique password for every work account

• Let the password manager [password manager name] create and remember your passwords.
• Use a long passphrase, such as several random words (at least [15] characters), for the few passwords you must remember, such as your computer and your password manager.
• Never reuse a work password anywhere else, and never use a personal password for work.
• Never share your password with anyone, including IT. We will never ask for it.
• Change a password straight away if you think someone else knows it.

Why: reused and stolen passwords are one of the most common ways attackers get in.

Rule 2. Always use multi-factor sign-in, and never approve a prompt you did not start

• Multi-factor sign-in means a second step after your password, such as a code or a tap on your phone. Set up [authenticator app / security key / passkey] when you join.
• If you get a sign-in prompt or code request you did not expect, deny it and report it (Rule 14).
• Never read out or forward a sign-in code to anyone, even someone who says they are from IT.

Why: a second step stops most attacks even when a password is stolen, unless someone tricks you into approving it.

Rule 3. Stop and check before you click, open or pay

• Be suspicious of messages that are urgent, unexpected, or ask for passwords, codes, payments or gift cards.
• Check the sender address and hover over links before clicking.
• Confirm any request to change bank details or make an unusual payment by phoning the person on a number you already know, not one in the message.
• Use the [Report phishing] button for suspicious emails. Do not forward them to colleagues.

Why: phishing and fake payment requests cost organizations money every day, and the person receiving the message is the last line of defence.

Rule 4. Lock your screen and protect your devices

• Lock your screen whenever you step away: [Windows key + L] or [Control + Command + Q].
• Keep your device with you or locked away. Never leave it visible in a car.
• Do not let family or friends use your work device.
• Install updates when asked; restart within [3] days.
• Do not switch off or work around security software.

Why: an unlocked or lost device gives someone everything you can access.

Rule 5. Use only approved devices, apps and services for work

• Do work on your company device. Use a personal phone for work only if IT has set it up for work use first (our "bring your own device" rules).
• Store and share work files only in [approved storage, for example the company file platform].
• Do not use personal email, personal cloud drives or messaging apps for work files.
• Ask IT before installing new software or signing up for a new online service for work.

Why: we cannot protect, back up or recover information stored in places we do not know about.

Rule 6. Know how sensitive information is, and handle it that way

• Our classification levels are [Public, Internal, Confidential, Restricted]. If you are not sure, treat it as Confidential.
• Label documents and emails with the right level using [labelling tool or header].
• Share Confidential information only with people who need it for their work.
• Never put Restricted information on paper, USB sticks or external drives unless your role allows it.

Why: the label tells everyone, including tools, how carefully to handle the information.

Rule 7. Share files and send emails carefully

• Check the recipient list before you press send, especially when the email client fills in names automatically.
• Share files with named people rather than "anyone with the link".
• Encrypt or use the secure sharing tool for Confidential files sent outside the organization.
• Do not forward work email to a personal account.

Why: "wrong recipient" and open sharing links are among the most common causes of personal data breaches.

Rule 8. Keep your desk and screen clear

• Put papers, USB sticks and external drives away when you leave your desk, and at the end of the day.
• Collect printouts at once. Where we have it, use secure printing: the printer waits until you tap your badge.
• Put paper you no longer need in the locked confidential waste bin or a cross-cut shredder.
• Remove whiteboard notes after meetings.

Why: visitors, cleaners and passers-by can see what you leave out.

Rule 9. Work safely from home and on the move

• Work where others cannot see your screen or hear Confidential calls.
• Connect through [the secure connection app, for example the VPN] and avoid open public Wi-Fi; use your phone's hotspot instead.
• Carry devices in hand luggage when travelling. Ask [@isms-manager] before travelling with work devices to a country on our travel list.
• Ask HR before you work from another country (approval is needed for more than [10] working days a year).

Why: at home and on the road you do not have the office's locked doors and protected network.

Rule 10. Protect personal data

• Personal data is any information about a person, such as a name, email address, phone number or health details.
• Use personal data only for the purpose it was collected for, and only the minimum you need.
• Do not copy customer or colleague data into spreadsheets, test systems or personal notes without approval.
• Pass any request from a person about their own data (to see, correct or delete it) to [privacy contact] the same day.

Why: people trust us with their data, and data protection laws such as the GDPR set strict rules and short deadlines.

Rule 11. Use AI tools only as approved

• Use only the AI tools listed as approved in our AI usage policy ([link]).
• Do not paste Confidential or personal information into public or consumer AI services.
• Check AI output before you use it: it can be wrong, biased or contain someone else's data.
• Say when content was produced with AI where our policy requires it.

Why: information typed into some AI services can be stored or used by the provider, outside our control.

Rule 12. Be careful with visitors, calls and social media

• Do not hold secure doors open for people you do not know; ask them to sign in at reception.
• Make sure your visitors are signed in and accompanied.
• Do not give information about colleagues, systems or customers to callers you cannot verify.
• Do not post photos that show screens, badges, whiteboards or office layouts on social media.

Why: attackers often ask, call or walk in rather than hack.

Rule 13. Return and wipe what you no longer need

• Return devices, badges and tokens when you leave or change role.
• Do not throw away or sell devices or storage media: give them to IT for secure wiping or destruction.
• Delete information you no longer need, following the retention rules for your team.

Why: old devices and forgotten files are a common source of leaks.

Rule 14. Report anything suspicious straight away

• Suspicious email: press [Report phishing].
• Something happening now, a lost device or you clicked: call [+00 000 000 000], day or night.
• Anything else: [service desk portal], category "Security event".
• Say what you saw, when, and what you did. Do not investigate or delete anything yourself.

Why: the sooner we know, the less harm is done, and some legal deadlines start the moment anyone in the organization knows.

4. Who to contact

5. Acknowledgement form

Employee Security Handbook acknowledgement

I confirm that:

1. I have received and read the Employee Security Handbook, version [1.0].
2. I understand the 14 rules in section 3 and where to find the full policies they come from.
3. I know how to report a security event (Rule 14 and section 4).
4. I understand that I can ask [@isms-manager] if anything is unclear.
5. I have been told what the organization monitors on work devices and accounts and where to read more (section 9 of the remote working policy, and the staff privacy notice).

Example record in the HR system: ACK-073-2027-0118 | Data analyst | version 1.0 | confirmed 2027-02-01 via learning platform.

6. Extra rules for some roles

7. Size tiers

8. Keeping the handbook working

8.1 Plain-language checks

Before each release:

1. Ask at least three people from non-technical roles to read sections 1 to 4 and note anything unclear.
2. Keep sentences short (aim for under 20 words), use "you" and "we", and explain any technical word the first time it appears.
3. Check that every tool name, button and phone number is current.
4. Check that each rule matches the current policy it comes from (section 10).

8.2 Translations

Translations carry the same version number as the English master.

8.3 Update triggers

Update the handbook at least once a year, and also when:

• a policy behind one of the rules changes;
• a new tool replaces an old one (for example a new password manager);
• incidents or phishing simulation results show a rule is not understood;
• staff feedback shows a rule does not work in practice.

8.4 Measures

Worked example (Example): at Quillmere Health Systems, 304 of 320 staff acknowledged version 1.1 within 30 days, which is 95.0 %. The 16 remaining staff (12 on leave, 4 new joiners in their first week) received reminders and completed within the next two weeks, giving 100 %.

9. Records and evidence

Acknowledgement and quiz records are personal data: limit access to HR, the awareness lead and the ISMS manager, and report to management in aggregate. Retention follows data/data-retention-deletion-standard.

10. Where the rules come from

11. References

• ISO/IEC 27001:2022, https://www.iso.org/standard/82875.html, with Amendment 1:2024, https://www.iso.org/standard/88435.html (clause 7.3 and Annex A controls cited by number only)
• ISO/IEC 27002:2022, https://www.iso.org/standard/75652.html
• NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program, September 2024, https://csrc.nist.gov/pubs/sp/800/50/r1/final
• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, July 2025, https://csrc.nist.gov/pubs/sp/800/63/b/4/final (basis for the 15-character minimum for passwords used on their own and for not forcing periodic password changes)
• Regulation (EU) 2016/679 (GDPR), as an example of data protection law
• Related templates: compliance/information-security-policy, compliance/acceptable-use-policy, security/security-awareness-program, isms/phishing-simulation-plan, isms/remote-working-policy, isms/security-event-reporting-procedure, ai-data/ai-usage-policy, isms/control-evidence-matrix

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 7.3 and Annex A control A.6.3, with each rule traced to the related Annex A controls, and with practical content informed by NIST SP 800-50 Rev. 1 and NIST SP 800-63B-4 (US Government works in the public domain). The text of this template is original. No ISO/IEC text is reproduced; control numbers and short descriptive labels only are used, and you need the official standards to read the requirements and guidance. Check the current editions before use. The acknowledgement form is a documentation format, not legal advice. Template licence: MIT.